PT-2025-22814 · Dnn · Dnn

Bdukes · Published 2025-02-18 · Updated 2025-08-26 · CVE-2025-48377

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions DNN (formerly DotNetNuke) versions prior to 9.13.9

Description A specially crafted URL may be constructed to inject an XSS payload that is triggered by using some module actions.

Recommendations For versions prior to 9.13.9, update to version 9.13.9 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-02481

CVE-2025-48377

GHSA-79M3-RVX2-3QQ9

Affected Products

Dnn

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48377.json · Exploit
• https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-79m3-rvx2-3qq9 · Vendor Advisory
• https://github.com/dnnsoftware/Dnn.Platform/commit/351b166492ad4b6509c273dc83211d52238e31a7 · Patch
• https://osv.dev/vulnerability/CVE-2025-48377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48377 · Security Note
• https://bdu.fstec.ru/vul/2025-02481 · Security Note
• https://osv.dev/vulnerability/GHSA-79m3-rvx2-3qq9 · Vendor Advisory
• https://github.com/dnnsoftware/Dnn.Platform · Note
• https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v9.13.9 · Note
• https://twitter.com/CVEnew/status/1926244423593042226 · Twitter Post
• https://t.me/cvetracker/24556 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1926021213911990719 · Twitter Post
• https://t.me/cveNotify/133456 · Telegram Post